The verdict API

mcp-audit.dev is an API with a website on top. Every server page renders the same JSON you can fetch. Static files, CORS enabled, no authentication, no rate cards.

Endpoints

GET /v1/index.json                            all packages, with paths
GET /v1/schema.json                           JSON Schema for a verdict
GET /v1/verdicts/{ecosystem}/{slug}.json      one verdict (npm or pypi)
GET /v1/badge/{ecosystem}/{slug}.json         shields.io endpoint badge

Slugs: @scope/name becomes at-scope-name, lowercase, with _ as -. A package that is not in the registry returns 404 with no body to parse; /v1/index.json lists every slug. JSON responses carry Access-Control-Allow-Origin: * and are cached for an hour.

mcp-audit vet <package> --online reads the same endpoint from your terminal.

Example

GET /v1/verdicts/npm/at-modelcontextprotocol-server-filesystem.json returns this document today:

{
 "schema_version": "1.0.0",
 "generated_at": "2026-10-25T17:44:25+00:00",
 "package": {
  "ecosystem": "npm",
  "name": "@modelcontextprotocol/server-filesystem"
 },
 "registry": {
  "listed": true,
  "verified": true,
  "maintainer": "Anthropic",
  "entry_updated": "2026-08-22",
  "registry_updated": "2026-10-25"
 },
 "known_vulnerabilities": [
  {
   "cve": "CVE-2025-53109",
   "cvss": null,
   "description": "@modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling",
   "fixed_in": "2025.7.1",
   "source": "NVD",
   "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-53109"
  },
  {
   "cve": "CVE-2025-53110",
   "cvss": null,
   "description": "@modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix",
   "fixed_in": "2025.7.1",
   "source": "NVD",
   "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-53110"
  }
 ],
 "capabilities": [
  "file_read",
  "file_write"
 ],
 "attestation": {
  "hash_pins_available": true,
  "attestation_expected": true
 },
 "typosquat_of": null,
 "tags": [
  "official",
  "filesystem",
  "local"
 ],
 "links": {
  "repo": "https://github.com/modelcontextprotocol/servers",
  "verdict_page": "https://mcp-audit.dev/servers/npm/at-modelcontextprotocol-server-filesystem/"
 }
}

GET /v1/badge/npm/at-modelcontextprotocol-server-filesystem.json returns:

{"schemaVersion": 1, "label": "mcp-audit", "message": "2 fixed CVEs", "color": "yellow"}

Fields

Field	Type	Meaning
`schema_version`	string	Semver of this document's schema. 1.0.0 today.
`generated_at`	string (date-time)	When the site was built.
`package.ecosystem`	string	npm or pypi.
`package.name`	string	Package name as published.
`registry.listed`	boolean	Always true: unlisted packages have no document (404).
`registry.verified`	boolean	The publisher showed evidence that they control the package.
`registry.maintainer`	string or null	Maintainer or organisation.
`registry.entry_updated`	string or null	Date the registry entry was last checked.
`registry.registry_updated`	string	Date of the registry release this document was built from.
`known_vulnerabilities[]`	array	One record per advisory: cve (the advisory ID, CVE or GHSA), cvss, description, fixed_in, source, link.
`known_vulnerabilities[].fixed_in`	string or null	First fixed version; null means no fix recorded.
`known_vulnerabilities[].source`	string	Always "NVD" in schema 1.0.0. Use link for the advisory's home: NVD for CVE IDs, GitHub for GHSA IDs, OSV otherwise.
`capabilities[]`	array of strings	Capability tags such as file_read or network_out.
`attestation.hash_pins_available`	boolean	The registry pins hashes for some versions.
`attestation.attestation_expected`	boolean	The package is known to publish Sigstore provenance.
`typosquat_of`	null	Reserved; always null on this site.
`tags[]`	array of strings	Registry tags such as official or remote.
`links.repo`	string or null	Source repository.
`links.verdict_page`	string	This package's page on mcp-audit.dev.

Versioning promise

The schema is semver'd (schema_version in every document) and additive only within /v1: fields are added, never renamed or removed. A breaking change means /v2.

Facts, not grades

The API publishes what can be checked: verification status, advisories with links, declared capabilities and hash pins. It does not grade packages, because a package's risk depends on how you deploy it.

No user data

The API holds data about public packages only. mcp-audit never sends scan results here, and this site sets no cookies and loads nothing from third parties.